ANF AC root inclusion request for ANF Secure Server Root CA

This case was ANF Autoridad de Certificación (ANF AC)'s request to include a new root certificate in Mozilla's Root Store and enable Websites trust, with EV treatment also discussed early in the thread. The request initially covered two roots, but ANF later narrowed it to the new ANF Secure Server Root CA only. Mozilla reviewers raised questions about audit criteria, CPS language, test certificate wording, and the need for a separate EKU-constrained issuing CA without codeSigning EKU. ANF responded by updating its CPS, obtaining an updated audit attestation, and issuing a new subordinate CA named ANF Secure Server CA. On 2021-04-08, Mozilla approved inclusion of ANF Secure Server Root CA for Websites and EV, and the bug was resolved FIXED.

1. 2019-10-03 ANF AC requested inclusion of two root certificates in Mozilla's Root Store and asked for EV treatment.
2. 2019-11-11 ANF AC narrowed the request to the new ANF Secure Server Root CA only.
3. 2020-11-09 ANF AC published updated CP/CPS documents and announced a new subordinate CA without the codeSigning EKU.
4. 2021-04-08 Mozilla approved inclusion of ANF Secure Server Root CA for Websites and EV.

1. 2019-10-03 Autoridad de Certificación (ANF AC) — Pablo Díaz opened the request, attached a BR self-assessment, and asked for inclusion of ANF Secure Server Root and ANF Global Root CA.
2. 2019-10-03 Community commenter — Ryan Sleevi noted issues from the previous bug, including auditor concerns and misissued test certificates.
3. 2019-10-30 Mozilla representative — Kathleen Wilson asked whether the request was for both roots or only the new ANF Secure Server Root CA.
4. 2019-11-11 Autoridad de Certificación (ANF AC) — Pablo confirmed the request would focus only on the new ANF Secure Server Root CA hierarchy.
5. 2020-09-28 Mozilla representative — Ben Wilson requested updated information about audits, CPS, and subordinate CAs.
6. 2020-11-05 Mozilla representative — Ben Wilson reviewed the CP/CPS and identified issues including licensing language and the need for a separate EKU-constrained issuing CA.
7. 2020-11-09 Autoridad de Certificación (ANF AC) — Pablo posted updated CP/CPS documents and announced the new ANF Secure Server CA subordinate.
8. 2021-04-08 Mozilla representative — Kathleen approved inclusion of ANF Secure Server Root CA for Websites and EV and said she would file the NSS and PSM bugs.